CVE-2026-119235

The proxygen HTTP/3 stack contains a vulnerability in its QPACK decoder . The decoder fails to enforce size limits on string literals in encoder-stream instructions until the entire literal is received. A remote, unauthenticated HTTP/3 peer can exploit this by sending an insert instruction with a...